Security Performance Management
Continuous Monitoring
Cyber Insurance
National Cybersecurity

Articles in this section

Service Provider Categories and Risks

Avatar
Ingrid
Follow
  • December 2, 2021: Linked to Bitsight for 4th Party.
  • January 16, 2020: Published.

⇤ Bitsight for 4th Party

Individual service providers are companies that provide a product. Refer to the following descriptions of the various product types and their associated risks:

Content Management System

Content Management Systems (CMS) manage the creation and modification of digital content, primarily for support and knowledge functions.

Product Type Description Risk
Call Center Call center services provide telephony services, auto-dialers, inbound and outbound call redirection.
  • Data exposure, including customer identity information.
  • Disruption of business continuity, including loss of customer confidence.
CMS (Content Management System) Content management system providers allow companies to remotely manage their websites, including changing and adding media and text.
  • Disruption of business continuity, including loss of customer confidence and loss in revenue.
  • Misuse of company assets; including the injection of malicious links or other code within the website.
Help Desk Help desk software is used by organizations to provide customer support to their clients in various forms. Including live chat and ticketing systems.
  • Data exposure; including customer contact information and private business information that are included in chat logs or ticket histories.
  • Disruption of business continuity, including loss of customer confidence.

⇪ Back to Directory

Customer Relationship Management

Customer Relationship Management (CRM) systems are used to manage a company's interaction with current and potential customers.

Product Type Description Risk
Relationship Management Relationship management software is used to manage business contacts, track discussions, business account development.
  • Data exposure; including client contact details and confidential business matters.
  • Disruption of business continuity; including loss of analytics data, loss of pipeline data, and loss of customer and client confidence.

⇪ Back to Directory

Enterprise

For-profit businesses or companies. These are often associated with entrepreneurial ventures and are run by a single individual.

Product Type Description Risk
Business Intelligence Business intelligence providers summarize data and provide reports.
  • Data exposure, including sensitive business data.
  • Disruption of business continuity, including a deprivation of critical business insights.
BPM (Business Process Management) Business process management software helps organizations streamline workflows, create new processes, and automate existing ones.
  • Data exposure, including proprietary information about the inner workings of an organization.
  • Disruption of business continuity, including a deprivation of critical business insights.
Business Solutions Business solutions providers host a range of software applications that cover all of an organization's operational needs.
  • Data exposure, including proprietary information about the inner workings of an organization.
  • Disruption of business continuity.
Enterprise Applications This category of service provider covers enterprise applications that do not have a special category. We are evaluating the impact of a disruption or compromise in this set of services.
Productivity Solutions Productivity solutions software is used to create documents, spreadsheets, presentations, charts, and other business documents.
  • Disruption of business continuity, including loss of effective communication channels.
  • Misuse of company assets; including malicious content injection, data theft, and data deletion.

⇪ Back to Directory

Finance

Involves managing assets, liabilities, revenues, and debts for a business. Defines all financial decisions and activities of an individual or household, including budgeting, insurance, mortgage planning, savings, and retirement planning.

Product Type Description Risk
Commerce A service that supply businesses with a digital storefront that includes the tools needed to buy and sell products and services over the Internet and manage their online enterprises. We are evaluating the impact of a disruption or compromise in this set of services.
Enterprise Resource Planning Enterprise resource planning software is used to track open orders, payroll, and materials inventory, and other business resources.
  • Data exposure; including financial data and logistics information.
  • Disruption of business continuity; including loss of customer confidence and loss in revenue.
Expense Management Expense management software is used to track credits and debits across company financial accounts as well as employee expenditures.
  • Data exposure, including sensitive financial data and banking details.
  • Disruption of business continuity; including loss of customer confidence and loss in revenue.
Financial Analytics Financial analytics enterprise software is used to create reports and analyses from an organization's financial data.
  • Data exposure, including information on business secrets and insider information.
  • Disruption of business continuity; including loss of critical financial insight capabilities and loss of stakeholder confidence.
Inventory Management Inventory management software helps organizations keep track of product stock levels.
  • Disruption of business continuity, including loss in revenue.
  • Data exposure; including financial information and supplier information.
  • Misuse of company assets, including logistical information.
Order Management Order management software is used to help control inventory, create order forms, manage pricing.
  • Data exposure, including payment information, purchase history, and supply levels.
  • Disruption of business continuity; including loss of customer confidence and loss in revenue.
Payment Processor Payment processors serve as intermediaries between merchants and various channels of payment (credit cards, debit cards, bank transfers), handling the transactions and crediting merchant accounts.
  • Data exposure depending on how data is stored, which includes credit card information.
  • Disruption of business continuity, including loss in revenue and loss of transaction records.
Procurement Solutions Procurement solutions software is used to manage automated purchase orders, invoice matching, and receiving orders.
  • Data exposure; including financial information, logistics processes, and purchasing strategy.
  • Disruption of business continuity, including delays or miscommunication in ordering.
SCM (Supply Chain Management) Supply chain management software is used to help execute purchase orders, manage inventory, source and manage suppliers.
  • Data exposure; including payment information, payment history, supplier contact information, and logistics information.
  • Disruption of business continuity; including loss of customer confidence and loss in revenue.

⇪ Back to Directory

Human Resources

Charged with finding, screening, recruiting, and training job applicants, and administering employee-benefit programs.

Product Type Description Risk
HR Management Human resources management software helps organizations manage employee benefits, contact information.
  • Data exposure, including employee data (social security numbers, bank account information, health information, and dental information).
  • Disruption of business continuity; including the timely filing and delivery of employee benefits.

⇪ Back to Directory

Information Technology

Information technology is the study, design, development, implementation, support or management of computer-based information systems—particularly software applications and computer hardware. IT functions are considered as subsets of information and communications technology.

Product Type Description Risk
Analytics and Monitoring Analytics and monitoring software include both qualitative web usage data (what is being used/ searched for) and quantitative data (how many times).
  • Disruption of business continuity, including a deprivation of critical business insights.
  • Misuse of company assets, including injection of malicious links or other code within the website.
Application Management Application management software is used by organizations to ensure that IT is used efficiently.
  • Data exposure; including sensitive information about company resources.
  • Disruption of business continuity.
Back-Up and Recovery Backup and recovery systems software help organizations store their data in case of data loss or corruption.
  • Data exposure, including sensitive company information.
  • Disruption of business continuity, including loss in revenue.
CDN (Content Delivery Network) A content delivery network optimizes delivery and performance of a company’s website, product, and services by copying and moving the data for these products and services geographically closer to regions of high demand.
  • Disruption of business continuity, including extended loading times, possible service downtime, and loss in revenue.
  • Vulnerability or exposure to malware that affects web assets and services.
Database Database management service providers manage access to databases, performance and reliability.
  • Data exposure, including database and content information.
  • Disruption of business continuity, including loss in revenue.
Disaster Recovery Disaster recovery services focus on restoring critical applications in case of data loss or corruption.
  • Data exposure, including access to copies of an organization’s data.
  • Disruption of business continuity, including loss in revenue.
DNS (Domain Name System) Domain Name System providers manage domain name resolution to one or more company domain names for selected IP addresses and other websites, products, and services owned by individual organizations.
  • Disruption of business continuity, including service downtime and unavailable content.
  • Misuse of company assets, including injection of malicious links or other code within the website.
Enterprise Mobility Management Mobility management services provide security and control for employee mobile devices in an organization.
  • Disruption of business continuity.
  • Vulnerability or exposure to malware, which affects employee devices.
Hardware This category is for hardware services and technology that do not fall into any other categories.
  • Disruption of business continuity depending on the importance of the service or hardware in question, which could affect the availability of service; including loss of customer confidence and loss in revenue.
  • Vulnerability or exposure to malware, which affects systems.
Hosting Hosting services can contain customer databases, website and web application files, and other code to make company services available to the Internet.
  • Data exposure, including information on intellectual property.
  • Disruption of business continuity, including loss in revenue.
  • Misuse of company assets.
IT Governance Information technology governance software helps organizations track IT department performance and helps ensure regulatory compliance.
  • Data exposure; including information on department inventory, information on the inner workings and operation procedures of an organization, and weaknesses, such as compliance in development.
  • Disruption of business continuity, including loss of insight into performance.
IT Management Information technology management software helps organizations manage employees' IT-related needs using ticketing or call systems.
  • Data exposure; including device information and information on the inner workings and operation procedures of an organization.
  • Disruption of business continuity, including loss of insight into management processes and loss of customer confidence.
IT Operations Information technology operations software helps organizations proactively identify IT problems in advance.
  • Data exposure, including information on the inner workings and operation procedures of an organization.
  • Disruption of business continuity, including, loss of insight into IT operation processes.
Mainframe Mainframe management services help improve server performance, stability, and may provide backup solutions.
  • Data exposure; including database information and information on the inner workings and operation procedures of an organization.
  • Disruption of business continuity, including loss in revenue.
Middleware Middleware management software helps organizations with software data gathering, analysis, and reporting.
  • Data exposure, including report information and software version information.
  • Disruption of business continuity, including loss of software analytics.
Networking This category is for networking software and applications that do not fall into other categories.
  • Data exposure, including network traffic.
  • Disruption of business continuity depending on the importance of the service.
  • Misuse of company assets; including the injection of malicious links or data into network traffic.
Network Management Network management software helps organizations optimize network and application performance.
  • Disruption of business continuity, including loss of performance insights.
  • Misuse of company assets; including redirection of core services and misleading networks to connect to servers with malicious software.
Operating Systems and Languages Operating systems and languages encompasses desktop, mobile, and embedded environments such as Linux, Mac OS, Windows, Unix, and others, on top of which end-user software runs, and computer languages used for development, such as ASP.NET, Apple iOS SDK.
  • Data exposure, including sensitive data depending on the responsibilities of the system.
  • Disruption of business continuity, including loss of customer confidence.
  • Misuse of company assets; including the injection of malicious links and potentially unwanted software into important systems.
Remote Server Solutions Remote server solutions software is used to connect and administer to organization servers and systems hosted off-site.
  • Disruption of business continuity; including loss of customer confidence and loss in revenue.
  • Misuse of company assets; including injection of malicious software and theft of an organization’s data.
Security Services A Certificate Authority is responsible for the authenticity of TLS/SSL certificates used by companies to establish encrypted communications. A valid certificate, signed by a known Certificate Authority, is used to establish trust when encryption is used between clients and servers.
  • Disruption of business continuity; including prevention of renewals, prevention of security certificate upgrades, loss of certain security verification services that rely on provider uptime.
  • Misuse of company assets; including the distribution of malware to customers, intercept legitimate communications (MITM attack), and obtain sensitive data.
Server Technologies Server technologies include some pre-configured software and hardware packages provided by companies.
  • Disruption of business continuity depending on how heavily an organization relies on the service, including loss in revenue.
  • Misuse of company assets; including injection of malicious content, theft of data, and hijacking of other services.
Software Configuration Management A service that enables software developers to track and control software changes. This includes revision control and establishing baselines. We are evaluating the impact of a disruption or compromise in this set of services.
Storage Storage management software is used to manage software products that store data on servers or other devices.
  • Disruption of business continuity, including loss of data and data backup capabilities.
  • Misuse of company assets; including downloading of data backups, erasing data backups, and the injection of malicious software.
Telephony Associated with the electronic transmission of voice, fax, or other information between distant parties using systems historically associated with the telephone, a handheld device containing both a speaker or transmitter and a receiver. We are evaluating the impact of a disruption or compromise in this set of services.
Virtualization Hosting Virtualization hosting is used to create virtual hardware platforms (spread across one or many physical systems) on which virtualization software runs.
  • Disruption of business continuity depending on how heavily an organization relies on these services; including loss of customer confidence and loss in revenue.
  • Misuse of company assets; including a takeover of critical systems, the injection of malicious links into a company’s web platform, and the injection of malicious software into company systems.
Virtualization Software Virtualization software is used by a single computer to to create and run one or more virtual environments.
  • Disruption of business continuity, including loss of performance insights.
  • Misuse of company assets; including a takeover of critical systems, the injection of malicious links into a company’s web platform, and the injection of malicious software into company systems.
Web Application Other web applications used in business operations that do not fall into existing categories.
  • Disruption of business continuity depending on the capabilities of the software, including loss of business insights.
  • Misuse of company assets depending on how embedded or exploitable a web application’s technology is; including the injection of malicious links into a company’s web platform and the injection of malicious software into company systems.

⇪ Back to Directory

Marketing

Promoting and selling products or services, including market research and advertising.

Product Type Description Risk
Ad Network A service that connects businesses with advertisers, as an affordable and efficient way to reach consumers. The ad network work with publishers who have the available ad space. The ad network then inventories the ad space, packages it, and then sells it to advertisers. We are evaluating the impact of a disruption or compromise in this set of services.
Analytics Web analytics services typically require some integration into a company’s website or product, and collect data about visitor and customer behavior, as well as application usage for reporting purposes.
  • Disruption of business continuity, including a deprivation of critical business insights.
  • Misuse of company assets, including the injection of malicious links or other code within the website.
Audio / Video Delivery Audio and video delivery services store media and make an organization's media content available on demand.
  • Disruption of business continuity, including loss of customer confidence.
  • Misuse of company assets, including the injection of malicious links or other code within the website.
Email Email providers store messages and handle message routing.
  • Disruption of business continuity, including loss of customer confidence.
  • Misuse of email capabilities; including the ability to send malicious email and access to private email.
Marketing Performance Management Marketing performance management software helps organizations with marketing budgeting, planning, metrics, and maximizing return on investment.
  • Data exposure, including information on the inner workings and operation procedures of an organization, budgeting information, expenditure history, marketing strategy, and future plans.
  • Disruption of business continuity, including loss of marketing analytic capabilities and loss of data integrity.
Media Media service providers deliver news and news-related content such as videos and podcasts.
  • Data exposure, including information on data streams.
  • Disruption of business continuity; including loss of customer confidence and loss in revenue.
  • Misuse of company assets; including the injection of malicious links, injection of malicious software into media pages.
Social Media A service that facilitates the creation and sharing of information, ideas, career interests and other forms of expression via interactive, virtual communities and networks. We are evaluating the impact of a disruption or compromise in this set of services.
Video Platform Video platform services are used to remotely deliver videos to end users.
  • Disruption of business continuity, including loss in revenue.
  • Misuse of company assets; including the injection of malicious links into a company’s web platform and the injection of malicious software into company systems.

⇪ Back to Directory

Other

Product Type Description Risk
Academic and Education Academics and education software are used to create and manage educational classes, manage student rosters, teacher rosters, and facilitate in other administrative tasks.
  • Data exposure; including personal contact information and financial information.
  • Disruption of business continuity, including loss of customer confidence.
Application Framework Web application frameworks are software systems that help standardize the way an organization's website works.
  • Disruption of business continuity; including loss of customer confidence and loss in revenue.
  • Misuse of company assets, including the injection of malicious links or other code within the website.
Change Management Change Management service providers help organizations with software changes, office changes, automated application testing, and issue management.
  • Data exposure, including information on the inner workings and operation procedures of an organization.
  • Disruption of business continuity, including loss in revenue.
Construction / Industrial Construction/Industrial management software is used for financial accounting, job scheduling, and reporting services in the industry.
  • Data exposure; including financial information, contract information, and contact information of employees.
  • Disruption of business continuity, including loss in revenue.
Electronic Data Exchange Data exchange services are used to translate and manage data being transmitted and received in various formats between organizations.
  • Data exposure, including company data.
  • Disruption of business continuity, including loss in revenue.
GRC (Governance Risk Compliance) Governance Risk Compliance software is used to help companies meet regulatory and compliance requirements.
  • Data exposure; including information into an organization’s security posture and weak areas of compliance.
  • Disruption of business continuity; including loss of critical risk management information and event logs.
Language The language category encompasses natural languages used by services and products. We have not determined any risk of a disruption or compromise in this set of services at this time.
Legal and Professional Services Legal and professional services software helps organizations manage and prepare documents and legal cases.
  • Data exposure; including financial information and sensitive information regarding legal case details.
  • Disruption of business continuity, including loss of customer confidence and loss in revenue.
Manufacturing / Engineering Manufacturing and engineering management software helps organizations monitor system development, acquisitions, and project completions.
  • Data exposure; including budget data, information on the inner workings and operation procedures of an organization, scheduling information, and proprietary development information.
  • Disruption of business continuity; including loss of customer confidence and loss in revenue.
Mapping Mapping providers deliver geographic or other map-based services.
  • Loss of customer confidence.
  • Misuse of company assets.
Medical / Healthcare Medical and healthcare management software helps organizations send paper billing, track patients' schedules, and manage claims.
  • Data exposure; including organizational expenditures, payer credentials, and sensitive patient details (SSN and medical histories).
  • Disruption of business continuity; including delayed claims, loss of information, loss of forms in transit, and loss in revenue.
Mobile Mobile software applies to applications used on phones and tablets.
  • Data exposure; including device information and inventories of installed software.
  • Disruption of business continuity.
Mobile Technologies Mobile technologies are used by phone and tablet manufacturers to provide services to end users.
  • Disruption of business continuity.
  • Misuse of company assets; including the injection of malicious links and the installation of potentially unwanted software.
Nonprofit / Fund Management A service that’s dedicated to furthering a particular social cause or advocating for a shared point of view. In economic terms, it is an organization that uses its surplus of the revenues to further achieve its ultimate objective, rather than distributing its income to the organization's shareholders, leaders, or members. We are evaluating the impact of a disruption or compromise in this set of services.
Performance Management Performance management software is used to improve workplace productivity, efficiency, and measure progress over time.
  • Data exposure, including operational information and report history information.
  • Disruption of business continuity, including loss of workplace performance analytic capabilities.
Printing This category includes printers and printer management software.
  • Disruption of business continuity depending on how heavily an organization relies on these services.
  • Data exposure; including device information and areas of weakness.
Property Management Property management software is used to track property incomes, status, renter contact information.
  • Data exposure; including financial payment information, payment history, and contact details (personal and business).
  • Disruption of business continuity, including loss in revenue.
Quality Management Quality management software is used to help organizations develop quality management systems for their processes.
  • Data exposure; including information on business thinking, business secrets, gaps in compliance coverage, and contact details of consultants.
  • Disruption of business continuity; including loss of quality analytics and loss of compliance records.
Reporting Reporting software is used to create all kinds of human-readable reports using various sources of data.
  • Data exposure; including data sources, executive summaries, report contents, and histories.
  • Disruption of business continuity, including loss of insight into business operations.
Retail Retail software is used to manage and provide point-of-sale systems to stores and retail chains.
  • Data exposure; including payment system information, customer credit information, and payment history.
  • Disruption of business continuity; including loss in revenue and loss of retail insights.
Search Engines A service that assists organizations in optimizing their web presence and gaining exposure. This includes search engine optimization (SEO) services, search engine marketing (SEM) services, website promotion, and website optimization services. We are evaluating the impact of a disruption or compromise in this set of services.
SIEM (Security Information and Event Management) Security information and event management software is used to aggregate and process multiple data streams, create reports, log events, and manage compliance.
  • Data exposure, including source data and information on confidential data streams.
  • Disruption of business continuity, including loss of critical business insights, loss of security insights, and loss of report data.
Server Server software is used to run operating systems in which other services (database, web, etc.) are active.
  • Disruption of business continuity depending on how heavily an organization relies on the service, including loss in revenue.
  • Misuse of company assets; including injection of malicious content, theft of data, or hijacking of other services.
Service and Field Support Service and field support software is used to track technical support staff and contractors, job status, parts, and contracts.
  • Data exposure; including client and contractor contact information, contractor whereabouts, purchase histories, and information on business interests.
  • Disruption of business continuity, including loss of customer confidence.
Shipping Shipping software is used to create packing slips, track shipments, manage orders, and assist with billing.
  • Data exposure; including payment and logistics information.
  • Disruption of business continuity, including loss in revenue.
Sustainability / Green Enterprise A service that facilitates in the decrease of negative environmental impact, while providing improved social and environmental benefits to consumers and producers. We are evaluating the impact of a disruption or compromise in this set of services.

⇪ Back to Directory

Related articles